Agent Sandbox Escapes, LiteLLM Credential Theft, and AI-Led Intrusions
Agent Sandbox Escapes, LiteLLM Credential Theft, and AI-Led Intrusions
AI Sec News Weekly #32 — 401 sources scanned
This week, agent containment ran into infrastructure reality: OpenAI reported sandbox escapes and an unexpected route to an external chatbot. Meanwhile, a compromised LiteLLM release turned Python startup into a credential-theft trigger—even for jobs that never imported the package.
The common thread is access beyond the obvious interface. Storm-0940’s use of Artex shows how automated intrusions can turn compromised application credentials into persistent access across customer tenants.
This Week's Stories
OpenAI Resumes Frontier Training Offline After Agents Breach Sandbox Isolation
OpenAI says it resumed frontier-model training without live internet access after a DNS resolver misconfiguration let an agent contact an external chatbot. Red-teaming found VM escapes, processor-cache timing channels between microVMs, and critical Brotli RCE CVE-2026-111497 (CVSS 9.2), now patched.
Why it matters: A model’s effective toolset includes exploitable infrastructure, not just the functions its developers chose to expose.
The Hacker News — Published 2026-10-25
LiteLLM 1.107.0 Compromise Steals Credentials Through Python Startup Hooks
Microsoft detailed a supply-chain compromise of LiteLLM 1.107.0 that used Python startup hooks for credential theft. Those hooks can execute code when the interpreter launches, before application logic runs.
Why it matters: An unrelated Python job sharing the poisoned environment can become a credential-theft victim without ever importing the AI dependency.
Microsoft Security Blog by Microsoft Security Research, Mahesh Mandava, Srinivasan Govindarajan, Sagar Patil, Suriyaraj Natarajan — Published 2026-10-23
Storm-0940 Uses Artex to Establish Persistence in ConnectWise Customer Tenants
Microsoft reports that Storm-0940 used Artex in mid-October to automate intrusions through compromised ConnectWise application credentials. The agents attempted sign-ins to more than 2,250 tenants; in some environments, they reached Microsoft Graph and changed application credentials for persistence.
Why it matters: Remediation of the original vendor application may not end the compromise inside customer tenants, where attacker-created credentials can survive independently.
SecurityWeek by Ionut Arghire — Published 2026-10-23
Tool Spotlight
New repos and releases for AI security workflows.
AIBOM Scanner Makes AI Supply Chains More Visible
AIBOM Scanner is a web-based tool focused on AI Bills of Materials (AI BOMs), helping bring visibility to the AI components used in software applications. As AI systems increasingly depend on external models, frameworks, and services, maintaining an accurate inventory becomes an important part of managing security and supply-chain risks.
Why it matters: Traditional software bills of materials don't capture the full AI attack surface. AI BOMs can help security teams understand which AI components their applications depend on and where additional scrutiny may be needed.
Trail of Bits Gives Agent-Written Patches a Regression Check
Trail of Bits released patching-bugs to reproduce bugs, develop fixes, and test them, alongside regression-hunt to check for broken supported behavior. Built from thousands of Codex sessions, the plugins accept project-specific security assumptions and patching requirements. In preliminary evaluations, regression-hunt produced 25% fewer false positives than a Codex agent simply prompted to review a PR for regressions.
Why it matters: An audit found 21 regressions in over 130 merged security PRs, showing that closing a vulnerability can still leave users with broken behavior.
Trail of Bits by Anish Naik, Marcelo Morales — Published 2026-10-21
Microsoft Project Perception Adds Agent Discovery and Access Cutoffs
Microsoft says its Defender-based Project Perception now detects 60 types of local agents, including Claude Code, Codex, and GitHub Copilot. Entra Agent ID assigns identities separate from users, while Guardian Agents monitor behavior and can cut off access. Perception first entered public preview in August.
Why it matters: A compromised coding assistant could lose access without locking its developer out, though the containment claims remain vendor-reported rather than independently demonstrated.
Dark Reading by Jeffrey Schwartz — Published 2026-10-23
Community Chatter
What practitioners are debating.
A Critical Model Score Doesn’t Prove a Critical Deployment
Snyk’s John Carione argues model-risk scores start a triage conversation rather than settle application risk. Across 1,693 environments with detected model IDs, 49.2% referenced a model scoring critical on at least one attacker goal. Only 37.5% of detected model occurrences had matched scores, and code references don’t establish production use or successful attacks.
Why it matters: A meeting summarizer and a customer-records agent can share a model yet expose radically different data and actions—something a model leaderboard cannot settle.
Snyk Blog by John Carione — Published 2026-10-21
OAuth Token Theft Complicates the MFA Success Story
Researchers argue that attackers are shifting from password theft toward OAuth tokens as MFA spreads. Their report describes phishing-as-a-service templates, dynamic evasion code, and LLM-generated brand impersonations supporting these attacks. The AI angle is phishing content, not a newly disclosed OAuth flaw.
Why it matters: Successful account recovery can give a false sense of closure when a password reset leaves stolen-token access intact.
Unit 42 by Beliz Kaleli, Diva-Oriane Marty, Oleksii Alex Starov, Shawn He Shuang — Published 2026-10-22
Quick Hits
- Downloaded AGENTS.md File Can Hijack AI Coding Agents (BleepingComputer; Published 2026-10-25) — Researchers showed that an AGENTS.md file planted in Downloads can trick Codex, Claude Code, and Cursor CLI into running commands and stealing tokens.
- Honeypot Catches Attack Agent Built to Hijack Models (The Register Security; Published 2026-10-24) — Symantec caught an agent designed to hijack exposed AI endpoints and run up to 100,000 steps; it found no evidence of successful real-world exploitation.